3.7 To Trust or Not To Trust Part 1 - ZN

00:00

Well, welcome back. We've got some more learning objectives to go over for the next section that we're gonna dive into,

00:07

and we're gonna start off with looking at trust in devices,

00:12

trusting users, trusting the applications and trust in the traffic. And really, how we go about doing that.

00:20

All right. We're also gonna take a look at the golden image. Um, you know, what is that? You know, why is that important in a zero trust network or in the traditional network?

00:29

We'll also look at a unified extensible firmware interface or U f. I will touch on that briefly and how that could play a role in trust in our devices. And then, ah, well, will skim over something called F w nap and how that could serve as a really cool lab

00:48

or test or something that you could even spend up in your production environment.

00:52

Um, to give you trust for a network traffic. Thanks so much. Stay tuned.

01:00

Hello and welcome back. And if this is your first time joining Thanks for stopping by.

01:04

To trust or not to trust, I would like to focus the remainder of this discussion around how we verify entities on the network to play some level of trust and then so we could be productive.

01:18

Now, zero trust networks will focus on how to trust devices, users, applications and traffic through different systems and processes.

01:34

So we start by talking about how we can trust the device.

01:38

The best practice that many of you may be familiar with is the golden image.

01:44

It is always best to load a known good image into a device before placing it into production.

01:49

No performing this task allows us to have some trust

01:53

at the device

01:56

that the device is secure, so golden images normally have fully patched operating systems and fully packed software. We kind of understand

02:06

what to expect from that device when it's

02:08

brought on to someone's desk or when we provided to new employees. So device hygiene is important, and it gives us confidence that device can be validated without an issue.

02:21

Another big step we can take on trust and devices is secure boot

02:25

and we confined in the latest Microsoft Windows computer is something called unified Extensible Firmware Interface or you E F I.

02:36

So six your boot like you e f. I helped a combat against malware and malicious attacks, a device firmware level.

02:45

We talked about device certificates as another attribute to help us verify our devices.

02:51

Client base certificates signed by certificate authority helps to enable some level of trust for our devices.

02:58

You know another area that helps us place trust in the device is software configuration management.

03:04

Now being able to do this give this tight control and a record of all software changes

03:10

that are made to critical infrastructure on the network.

03:15

Now there are many other things that can be applied to devices that make trusting them more scalable.

03:22

So I encourage you to take a look at the supplemental material

03:25

that you will be shown later in the discussion on help You go deeper.

03:32

So let's move on to trusting users.

03:37

Trust in a user will always start off with a human element.

03:42

You know, we see this in the form of interviews, by phone and in person before any trust can really be established.

03:49

We wouldn't create an account for someone we only talk with by email and then afterwards send them a computer for them to log in for the first time in use.

04:00

It needs to be a little bit more personal.

04:01

I imagine if you had Children and they want to sleep over at a friend's house, you as a parent or guardian, would want to meet the parents and visit the home where your child would spend the night. Correct.

04:14

So

04:15

zero trust is not in favor of email. Only introductions to new employees.

04:20

The hiring manager and others in the interview process can help with a human based authentication that allows for the digital entity or identity to be created

04:31

now. Once created, storing that identity becomes really important.

04:36

So centralizing these accounts into a directory helps inform and trust.

04:42

So zero trust networks will want to storm or information outside of traditional information, such as user names, contact numbers and role in the organization. Right, so zero trust

04:56

will want the user location,

04:58

who they report to,

05:00

and maybe even the user's public key. If certificates are deployed for extra authentication, right?

05:08

So how do we authenticate identity?

05:11

Well, we have three ways to identify a user

05:14

something they know,

05:15

such as a password.

05:17

Something that they have

05:19

an example would be a token or keep Bob

05:24

and then something they are. An example would be a fingerprint

05:28

or your retina when you use biometrics for authentication.

05:33

And zero, Trust really prefers authenticating with one more than one of these methods, especially for highly critical systems. So pairing two of these methods together provides stronger security for user authentication.

05:49

An example would be, ah, user trying to authenticate to a workstation.

05:54

The users should have a password, something you know and a token, something you have for strong authentication.

06:01

Another example would be a user authenticating to a mobile device.

06:06

User could use a fingerprint,

06:09

something you are and a pass phrase something you know for access.

06:15

So when dealing with passwords, we could make it stronger by Flynn,

06:18

but also by using random password generators. Ah, lot of secret server password bolt products offer this feature now believe Microsoft's local account, password solution or lapse behaves this way as well. For local administrative accounts

06:36

now, and password should not be. You reused right. A lot of people have a tendency to use their corporate password to sign up for Facebook or late then, and that's not a good idea. It's a better idea to use different passwords for each account and manage them using a password manager

06:56

Now, if they are or professionally use, you know, work with your I T departments. Implement things like Single sign on will provide enterprise password management solutions for your employees.